From 49e301329d4ec41427aa8da0e128bd72999c8f9c Mon Sep 17 00:00:00 2001 From: adityamehra Date: Mon, 29 Jun 2026 16:15:54 -0700 Subject: [PATCH] fix(ci): harden version validation and verify sed substitutions in release pipelines Two security/reliability improvements applied to all three PyPI release workflows (splunk-ao, splunk-ao-adk, splunk-ao-a2a): 1. Switch grep -Eq to bash [[ =~ ]] for version validation grep -E matches on a per-line basis, so a multi-line input like "0.1.0\n" passes the check even though it is not a valid version. bash [[ =~ ]] anchors ^ and $ to the entire string, making multi-line inputs impossible to sneak through. 2. Verify each sed substitution actually matched If the version line format in pyproject.toml or the __version__ file ever drifts, sed silently no-ops and the build proceeds with the stale version. Added grep -q assertions after each sed call so a mismatch fails loudly instead of producing a silent wrong-version release. Co-authored-by: Cursor --- .github/workflows/release-splunk-ao-a2a.yaml | 12 +++++++++++- .github/workflows/release-splunk-ao-adk.yaml | 12 +++++++++++- .github/workflows/release-splunk-ao.yaml | 12 +++++++++++- 3 files changed, 33 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-splunk-ao-a2a.yaml b/.github/workflows/release-splunk-ao-a2a.yaml index 53ea70c3..3d752a41 100644 --- a/.github/workflows/release-splunk-ao-a2a.yaml +++ b/.github/workflows/release-splunk-ao-a2a.yaml @@ -31,12 +31,22 @@ jobs: env: INPUT_VERSION: ${{ inputs.version }} run: | - if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then + # Use bash [[ =~ ]] so ^ and $ anchor the entire string, preventing + # multi-line inputs from bypassing the validation (grep -E matches per line). + if [[ ! "$INPUT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$ ]]; then echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted." exit 1 fi sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml + if ! grep -q "^version = \"${INPUT_VERSION}\"" pyproject.toml; then + echo "::error::Failed to set version in pyproject.toml — the version line format may have changed." + exit 1 + fi sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_a2a/_version.py + if ! grep -q "__version__ = \"${INPUT_VERSION}\"" src/splunk_ao_a2a/_version.py; then + echo "::error::Failed to set __version__ in src/splunk_ao_a2a/_version.py — the version line format may have changed." + exit 1 + fi - name: Get current version id: get-version diff --git a/.github/workflows/release-splunk-ao-adk.yaml b/.github/workflows/release-splunk-ao-adk.yaml index 67479db9..925911ac 100644 --- a/.github/workflows/release-splunk-ao-adk.yaml +++ b/.github/workflows/release-splunk-ao-adk.yaml @@ -31,12 +31,22 @@ jobs: env: INPUT_VERSION: ${{ inputs.version }} run: | - if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then + # Use bash [[ =~ ]] so ^ and $ anchor the entire string, preventing + # multi-line inputs from bypassing the validation (grep -E matches per line). + if [[ ! "$INPUT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$ ]]; then echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted." exit 1 fi sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml + if ! grep -q "^version = \"${INPUT_VERSION}\"" pyproject.toml; then + echo "::error::Failed to set version in pyproject.toml — the version line format may have changed." + exit 1 + fi sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_adk/__init__.py + if ! grep -q "__version__ = \"${INPUT_VERSION}\"" src/splunk_ao_adk/__init__.py; then + echo "::error::Failed to set __version__ in src/splunk_ao_adk/__init__.py — the version line format may have changed." + exit 1 + fi - name: Get current version id: get-version diff --git a/.github/workflows/release-splunk-ao.yaml b/.github/workflows/release-splunk-ao.yaml index fabfbcf5..8f626a64 100644 --- a/.github/workflows/release-splunk-ao.yaml +++ b/.github/workflows/release-splunk-ao.yaml @@ -31,12 +31,22 @@ jobs: env: INPUT_VERSION: ${{ inputs.version }} run: | - if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then + # Use bash [[ =~ ]] so ^ and $ anchor the entire string, preventing + # multi-line inputs from bypassing the validation (grep -E matches per line). + if [[ ! "$INPUT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$ ]]; then echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted." exit 1 fi sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml + if ! grep -q "^version = \"${INPUT_VERSION}\"" pyproject.toml; then + echo "::error::Failed to set version in pyproject.toml — the version line format may have changed." + exit 1 + fi sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao/__init__.py + if ! grep -q "__version__ = \"${INPUT_VERSION}\"" src/splunk_ao/__init__.py; then + echo "::error::Failed to set __version__ in src/splunk_ao/__init__.py — the version line format may have changed." + exit 1 + fi - name: Get current version id: get-version